CVE-2020-5226 json
Cross-site scripting in SimpleSAMLphp
published 2020-01-24 6 y ago modified 2026-09-10 1 mo ago also GHSA-mj9p-v2r8-wf8w , EUVD-2020-0271
- cvss
- 4.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 45%
- public exploits
- 0
- none known
Summary
Cross-site scripting in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script allows error reports to be submitted and sent to the system administrator. Starting with SimpleSAMLphp 1.18.0, a new SimpleSAML\Utils\EMail class was introduced to handle sending emails, implemented as a wrapper of an external dependency. This new wrapper allows us to use Twig templates in order to create the email sent with an error report. Since Twig provides automatic escaping of variables, manual escaping of the free-text field in www/errorreport.php was removed to avoid double escaping. However, for those not using the new user interface yet, an email template is hardcoded into the class itself in plain PHP. Since no escaping is provided in this template, it is then possible to inject HTML inside the template by manually crafting the contents of the free-text field.
Patch / fix
- packagist simplesamlphp/simplesamlphp 1.18.4
- simplesamlphp simplesamlphp 1.18.4
- simplesamlphp Debian 14, Debian 12 1.18.4-1
debian advisories DEBIAN-CVE-2020-5226
Exploit prediction
0.54% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.4 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 3.5 | AV:N/AC:M/Au:S/C:N/I:P/A:N |
| GitHub | 3.1 | 4.4 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | simplesamlphp/simplesamlphp | >=1.18.0, <1.18.4 |
1.18.4 |
Affected products
- simplesamlphp SimpleSAMLphp
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
simplesamlphp.org
/security/202001-01
web, vendor-advisory
-
github.com
/simplesamlphp/simplesamlphp/security/advisories/GHSA-mj9p-v2r8-wf8w
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-5226
advisory
Sources
- CVE List CVE-2020-5226
- GitHub Advisory GHSA-mj9p-v2r8-wf8w
- NVD CVE-2020-5226
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.